@wrongstack/tools 0.32.0 → 0.51.3

package/dist/index.js

@@ -1,8 +1,8 @@
 import * as fs4 from 'node:fs/promises';
-import { stat } from 'node:fs/promises';
 import * as path from 'node:path';
 import { resolve, sep, dirname } from 'node:path';
-import { atomicWrite, unifiedDiff, detectNewlineStyle, normalizeToLf, toStyle, compileGlob, buildChildEnv, loadPlan, emptyPlan, clearPlan, savePlan, getPlanTemplate, addPlanItem, deriveTodosFromPlanItem, removePlanItem, setPlanItemStatus, formatPlan, stripAnsi, resolveWstackPaths } from '@wrongstack/core';
+import * as Core from '@wrongstack/core';
+import { atomicWrite, unifiedDiff, detectNewlineStyle, normalizeToLf, toStyle, compileGlob, buildChildEnv, loadPlan, emptyPlan, clearPlan, savePlan, getPlanTemplate, addPlanItem, deriveTodosFromPlanItem, removePlanItem, setPlanItemStatus, formatPlan, resolveWstackPaths } from '@wrongstack/core';
 import { spawn, execFileSync, spawnSync } from 'node:child_process';
 import * as os from 'node:os';
 import * as dns from 'node:dns/promises';
@@ -19,6 +19,20 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
+async function detectPackageManager(cwd) {
+  const { stat: stat10 } = await import('node:fs/promises');
+  try {
+    await stat10(`${cwd}/pnpm-lock.yaml`);
+    return "pnpm";
+  } catch {
+  }
+  try {
+    await stat10(`${cwd}/yarn.lock`);
+    return "yarn";
+  } catch {
+  }
+  return "npm";
+}
 function resolvePath(input, ctx) {
   return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);
 }
@@ -141,7 +155,7 @@ ${tail}`;
 }
 function normalizeCommandOutput(raw, opts = {}) {
   if (!raw) return raw;
-  let text = stripAnsi(raw);
+  let text = Core.stripAnsi(raw);
   text = collapseCarriageReturns(text);
   text = text.replace(/[ \t]+$/gm, "");
   text = collapseConsecutiveDuplicates(text);
@@ -182,9 +196,9 @@ var readTool = {
   async execute(input, ctx) {
     if (!input?.path) throw new Error("read: path is required");
     const absPath = await safeResolveReal(input.path, ctx);
-    let stat11;
+    let stat10;
     try {
-      stat11 = await fs4.stat(absPath);
+      stat10 = await fs4.stat(absPath);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") throw new Error(`read: file not found "${input.path}"`);
@@ -192,9 +206,9 @@ var readTool = {
         `read: failed to stat "${input.path}": ${err instanceof Error ? err.message : String(err)}`
       );
     }
-    if (!stat11.isFile()) throw new Error(`read: "${input.path}" is not a regular file`);
-    if (stat11.size > MAX_BYTES) {
-      throw new Error(`read: file too large (${stat11.size} bytes, limit ${MAX_BYTES})`);
+    if (!stat10.isFile()) throw new Error(`read: "${input.path}" is not a regular file`);
+    if (stat10.size > MAX_BYTES) {
+      throw new Error(`read: file too large (${stat10.size} bytes, limit ${MAX_BYTES})`);
     }
     const buf = await fs4.readFile(absPath);
     if (isBinaryBuffer(buf)) {
@@ -206,14 +220,14 @@ var readTool = {
     const offset = Math.max(1, input.offset ?? 1);
     const limit = Math.max(0, Math.min(input.limit ?? 2e3, 5e3));
     if (limit === 0) {
-      ctx.recordRead(absPath, stat11.mtimeMs);
+      ctx.recordRead(absPath, stat10.mtimeMs);
       return { text: "", total_lines: total, encoding: "utf8", truncated: total > 0 };
     }
     const slice = allLines.slice(offset - 1, offset - 1 + limit);
     const truncated = offset - 1 + slice.length < total;
     const width = String(offset + slice.length - 1).length;
     const numbered = slice.map((line, i) => `${String(offset + i).padStart(width, " ")}\u2192${line}`).join("\n");
-    ctx.recordRead(absPath, stat11.mtimeMs);
+    ctx.recordRead(absPath, stat10.mtimeMs);
     return {
       text: numbered,
       total_lines: total,
@@ -252,12 +266,12 @@ var writeTool = {
     let existed = false;
     let prev = "";
     try {
-      const stat12 = await fs4.stat(absPath);
-      existed = stat12.isFile();
+      const stat11 = await fs4.stat(absPath);
+      existed = stat11.isFile();
       if (existed) {
         if (!ctx.hasRead(absPath)) {
           prev = await fs4.readFile(absPath, "utf8");
-          ctx.recordRead(absPath, stat12.mtimeMs);
+          ctx.recordRead(absPath, stat11.mtimeMs);
         } else {
           prev = await fs4.readFile(absPath, "utf8");
         }
@@ -270,8 +284,8 @@ var writeTool = {
     await atomicWrite(absPath, input.content);
     const diff = existed ? unifiedDiff(prev, input.content, { fromFile: input.path, toFile: input.path }) : `+++ ${input.path}
 + (new file, ${input.content.split("\n").length} lines)`;
-    const stat11 = await fs4.stat(absPath);
-    ctx.recordRead(absPath, stat11.mtimeMs);
+    const stat10 = await fs4.stat(absPath);
+    ctx.recordRead(absPath, stat10.mtimeMs);
     ctx.session.recordFileChange({
       path: absPath,
       action: existed ? "modified" : "created",
@@ -311,13 +325,13 @@ var editTool = {
     if (input.new_string === void 0) throw new Error("edit: new_string is required");
     if (input.old_string === "") throw new Error("edit: old_string cannot be empty");
     const absPath = await safeResolveReal(input.path, ctx);
-    const stat11 = await fs4.stat(absPath).catch((err) => {
+    const stat10 = await fs4.stat(absPath).catch((err) => {
       if (err.code === "ENOENT") {
         throw new Error(`edit: file "${input.path}" does not exist. Use \`write\` instead.`);
       }
       throw err;
     });
-    if (!stat11.isFile()) throw new Error(`edit: "${input.path}" is not a regular file`);
+    if (!stat10.isFile()) throw new Error(`edit: "${input.path}" is not a regular file`);
     if (!ctx.hasRead(absPath)) {
       throw new Error(`edit: file "${input.path}" was not read in this session. Read it first.`);
     }
@@ -511,8 +525,8 @@ var replaceTool = {
       }
       const rel = path.relative(realRoot, realPath);
       if (rel.startsWith("..") || path.isAbsolute(rel)) continue;
-      const stat11 = await fs4.stat(realPath).catch(() => null);
-      if (!stat11 || !stat11.isFile()) continue;
+      const stat10 = await fs4.stat(realPath).catch(() => null);
+      if (!stat10 || !stat10.isFile()) continue;
       let content;
       try {
         const buf = await fs4.readFile(realPath);
@@ -537,7 +551,7 @@ var replaceTool = {
       totalReplacements += count;
       if (!dryRun) {
         const newContent = toStyle(newContentLf, style);
-        await atomicWrite(realPath, newContent, { mode: stat11.mode & 511 });
+        await atomicWrite(realPath, newContent, { mode: stat10.mode & 511 });
       }
       const diff = dryRun || matches.length > 0 ? unifiedDiff(content, toStyle(newContentLf, style), {
         fromFile: absPath,
@@ -567,8 +581,8 @@ async function resolveFiles(filesInput, ctx, extraGlob) {
   const resolved = [];
   for (const p of parts) {
     const absPath = safeResolve(p, ctx);
-    const stat11 = await fs4.stat(absPath).catch(() => null);
-    if (stat11?.isFile()) {
+    const stat10 = await fs4.stat(absPath).catch(() => null);
+    if (stat10?.isFile()) {
       resolved.push(absPath);
     }
   }
@@ -626,8 +640,8 @@ async function globNative(pattern, base, extraGlob) {
       if (DEFAULT_IGNORE.includes(e.name)) continue;
       const full = path.join(dir, e.name);
       try {
-        const stat11 = await fs4.lstat(full);
-        if (stat11.isSymbolicLink()) continue;
+        const stat10 = await fs4.lstat(full);
+        if (stat10.isSymbolicLink()) continue;
       } catch {
         continue;
       }
@@ -976,8 +990,8 @@ async function runNative(input, base, mode, limit, signal) {
         if (globRe && !globRe.test(e.name) && !globRe.test(full)) continue;
         if (globRe) globRe.lastIndex = 0;
         try {
-          const stat11 = await fs4.stat(full);
-          if (stat11.size > 1e6) continue;
+          const stat10 = await fs4.stat(full);
+          if (stat10.size > 1e6) continue;
           const head = await fs4.readFile(full);
           if (isBinaryBuffer(head)) continue;
           const text = head.toString("utf8");
@@ -2510,15 +2524,26 @@ var planTool = {
   category: "Session",
   description: "Manage a persistent strategic plan for the current session. Unlike todos, plans are meant for higher-level, multi-phase approaches and survive across conversation resumptions. Use this to outline big-picture work, then promote concrete items into the todo list when ready to execute.",
   usageHint: 'RECOMMENDED FOR COMPLEX, MULTI-PHASE WORK:\n\n- Start by creating a high-level plan with `action: "add"` or using templates (`template_use`).\n- Use `promote` to turn a plan item into actionable todos.\n- Keep plans at the "why and what" level, and todos at the "how and next step" level.\n- Common templates: "new-feature", "bug-fix", "refactor", "release", "security-audit".\n\nThis tool is excellent for maintaining long-term direction across many turns or even multiple sessions.',
-  permission: "auto",
-  mutating: false,
+  permission: "confirm",
+  mutating: true,
+  capabilities: ["fs.write"],
   timeoutMs: 2e3,
   inputSchema: {
     type: "object",
     properties: {
       action: {
         type: "string",
-        enum: ["show", "add", "start", "done", "remove", "promote", "derive", "template_use", "clear"],
+        enum: [
+          "show",
+          "add",
+          "start",
+          "done",
+          "remove",
+          "promote",
+          "derive",
+          "template_use",
+          "clear"
+        ],
         description: "The operation to perform on the plan board."
       },
       title: {
@@ -2611,7 +2636,12 @@ var planTool = {
         plan = derived.plan;
         await savePlan(planPath, plan);
         ctx.state.replaceTodos(derived.todos);
-        return mkResult(plan, true, `${input.action} ok \u2014 ${derived.todos.length} todo(s) created.`, derived.todos);
+        return mkResult(
+          plan,
+          true,
+          `${input.action} ok \u2014 ${derived.todos.length} todo(s) created.`,
+          derived.todos
+        );
       }
       case "template_use": {
         const templateName = input.template?.trim();
@@ -2626,7 +2656,11 @@ var planTool = {
           ({ plan } = addPlanItem(plan, item.title, item.details));
         }
         await savePlan(planPath, plan);
-        return mkResult(plan, true, `Applied template "${template.name}" \u2014 ${template.items.length} items added.`);
+        return mkResult(
+          plan,
+          true,
+          `Applied template "${template.name}" \u2014 ${template.items.length} items added.`
+        );
       }
       case "clear":
         plan = clearPlan(plan);
@@ -2772,8 +2806,8 @@ function findGitDir(cwd, projectRoot) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat11 = statSync(`${dir}/.git`);
-      if (stat11.isDirectory() || stat11.isFile()) return dir;
+      const stat10 = statSync(`${dir}/.git`);
+      if (stat10.isDirectory() || stat10.isFile()) return dir;
     } catch {
     }
     if (dir === root) break;
@@ -3127,8 +3161,8 @@ function toYaml(data, indent = 0) {
 var diffTool = {
   name: "diff",
   category: "Filesystem",
-  description: "Show code differences between files, commits, branches, or staged changes. A safer and more structured alternative to raw `git diff` via shell.",
-  usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 diff working tree vs HEAD for those files.\n- `a` and/or `b` \u2192 git-style commit/branch diff.\n- `staged: true` \u2192 only show staged changes.\n- `mode` can be "unified", "stat", or "side-by-side".\nThis tool has important safety guards against flag injection (see previous security findings).',
+  description: "Show file content with line numbers, staged/working-tree diffs via git, or commit/branch diffs. A safer and more structured alternative to raw `git diff` via shell.",
+  usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes).\n- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\n- `staged: true` \u2192 only show staged changes.\n- `mode` can be "unified", "stat", or "side-by-side" (only affects the git-diff path).\n\nNOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\n\nThis tool has important safety guards against flag injection (see previous security findings).',
   permission: "auto",
   mutating: false,
   capabilities: ["fs.read"],
@@ -3205,8 +3239,8 @@ function findGitDir2(cwd) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat11 = statSync(path.join(dir, ".git"));
-      if (stat11.isDirectory()) return dir;
+      const stat10 = statSync(path.join(dir, ".git"));
+      if (stat10.isDirectory()) return dir;
     } catch {
     }
     const parent = path.dirname(dir);
@@ -3236,7 +3270,7 @@ function runGit2(args, cwd, signal) {
   });
 }
 async function fileDiff(input, ctx, _signal) {
-  input.context ?? 3;
+  void input.context;
   const files = input.files ? (Array.isArray(input.files) ? input.files : input.files.split(",")).map((f) => f.trim()).filter(Boolean) : [];
   if (files.length === 0) {
     return {
@@ -3249,23 +3283,24 @@ async function fileDiff(input, ctx, _signal) {
   const results = [];
   for (const file of files) {
     const absPath = safeResolve(file, ctx);
-    const stat11 = await fs4.stat(absPath).catch(() => null);
-    if (!stat11?.isFile()) continue;
+    const stat10 = await fs4.stat(absPath).catch(() => null);
+    if (!stat10?.isFile()) continue;
     const content = await fs4.readFile(absPath, "utf8");
     const lines = content.split(/\r?\n/);
-    results.push(`--- ${file}
-+++ ${file}
-${formatUnified(lines)}`);
+    results.push(formatWithLineNumbers(file, lines));
   }
   return {
-    diff: results.join("\n"),
+    diff: results.join("\n\n"),
     files,
     truncated: false,
     mode: input.mode ?? "unified"
   };
 }
-function formatUnified(lines, _context) {
-  return lines.map((line, _i) => ` ${line}`).join("\n");
+function formatWithLineNumbers(file, lines) {
+  const width = String(lines.length).length;
+  const numbered = lines.map((line, i) => `${String(i + 1).padStart(width)} | ${line}`).join("\n");
+  return `--- ${file} (line-numbered dump, not a unified diff) ---
+${numbered}`;
 }
 var DEFAULT_IGNORE4 = [
   "node_modules",
@@ -3599,11 +3634,11 @@ var lintTool = {
   }
 };
 async function detectLinter(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat10 } = await import('node:fs/promises');
   const checks = ["biome.json", ".eslintrc.json", "tslint.json", ".eslintrc.js", "tsconfig.json"];
   for (const f of checks) {
     try {
-      await stat11(`${cwd}/${f}`);
+      await stat10(`${cwd}/${f}`);
       if (f.includes("biome")) return "biome";
       if (f.includes("eslint")) return "eslint";
       if (f.includes("tslint")) return "tslint";
@@ -3621,6 +3656,7 @@ var formatTool = {
   usageHint: "RUN REGULARLY:\n\n- Use on changed files before committing.\n- `check: true` verifies formatting without making changes (useful in CI-like flows).\nThis project has very consistent formatting expectations. Always ensure your changes are formatted.",
   permission: "confirm",
   mutating: true,
+  capabilities: ["fs.write", "shell.exec"],
   timeoutMs: 6e4,
   inputSchema: {
     type: "object",
@@ -3698,13 +3734,13 @@ var formatTool = {
   }
 };
 async function detectFixer(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat10 } = await import('node:fs/promises');
   try {
-    await stat11(`${cwd}/biome.json`);
+    await stat10(`${cwd}/biome.json`);
     return "biome";
   } catch {
     try {
-      await stat11(`${cwd}/.prettierrc`);
+      await stat10(`${cwd}/.prettierrc`);
       return "prettier";
     } catch {
       return "biome";
@@ -3780,11 +3816,11 @@ var typecheckTool = {
   }
 };
 async function findTsConfig(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat10 } = await import('node:fs/promises');
   const candidates = ["tsconfig.json", "tsconfig.base.json"];
   for (const f of candidates) {
     try {
-      const s = await stat11(path.join(cwd, f));
+      const s = await stat10(path.join(cwd, f));
       if (s.isFile()) return path.join(cwd, f);
     } catch {
     }
@@ -3861,11 +3897,11 @@ var testTool = {
   }
 };
 async function detectRunner(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat10 } = await import('node:fs/promises');
   const candidates = ["vitest.config.ts", "jest.config.js", ".mocharc.json"];
   for (const f of candidates) {
     try {
-      await stat11(path.join(cwd, f));
+      await stat10(path.join(cwd, f));
       if (f.includes("vitest")) return "vitest";
       if (f.includes("jest")) return "jest";
       if (f.includes("mocha")) return "mocha";
@@ -4042,20 +4078,6 @@ var installTool = {
     };
   }
 };
-async function detectPackageManager(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
-  try {
-    await stat11(`${cwd}/pnpm-lock.yaml`);
-    return "pnpm";
-  } catch {
-    try {
-      await stat11(`${cwd}/yarn.lock`);
-      return "yarn";
-    } catch {
-      return "npm";
-    }
-  }
-}
 
 // src/audit.ts
 var auditTool = {
@@ -4089,7 +4111,7 @@ var auditTool = {
   },
   async *executeStream(input, ctx, opts) {
     const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
-    const manager = await detectManager(cwd);
+    const manager = await detectPackageManager(cwd);
     yield { type: "log", text: `Auditing with ${manager}\u2026`, data: { manager } };
     const args = ["audit", "--json"];
     if (input.fix) args.push("--fix");
@@ -4107,20 +4129,6 @@ var auditTool = {
     yield { type: "final", output: parseAuditOutput(result.stdout, result.exitCode) };
   }
 };
-async function detectManager(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
-  try {
-    await stat11(`${cwd}/pnpm-lock.yaml`);
-    return "pnpm";
-  } catch {
-  }
-  try {
-    await stat11(`${cwd}/yarn.lock`);
-    return "yarn";
-  } catch {
-  }
-  return "npm";
-}
 function parseAuditOutput(json, exitCode) {
   if (!json) {
     return {
@@ -4172,7 +4180,7 @@ var outdatedTool = {
   description: "Check for outdated dependencies in the project. Reports current, wanted (semver range), and latest versions available.",
   usageHint: "MAINTENANCE & SECURITY TOOL:\n\n- Run periodically or before dependency-related work.\n- Helps surface packages that may need updates for security or features.\n- Safe, read-only operation.\nUse the output to decide on upgrades. Prefer this over manual shell commands for dependency hygiene.",
   permission: "auto",
-  mutating: true,
+  mutating: false,
   timeoutMs: 6e4,
   inputSchema: {
     type: "object",
@@ -4195,26 +4203,13 @@ var outdatedTool = {
   },
   async execute(input, ctx, opts) {
     const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
-    const manager = await detectManager2(cwd);
+    const manager = await detectPackageManager(cwd);
     const args = ["outdated", "--json"];
     if (input.format === "table") args.push("--table");
     if (input.include_deprecated) args.push("--include", "deprecated");
     return runOutdated(manager, args, cwd, opts.signal);
   }
 };
-async function detectManager2(cwd) {
-  try {
-    await stat(`${cwd}/pnpm-lock.yaml`);
-    return "pnpm";
-  } catch {
-  }
-  try {
-    await stat(`${cwd}/yarn.lock`);
-    return "yarn";
-  } catch {
-  }
-  return "npm";
-}
 function runOutdated(manager, args, cwd, signal) {
   return new Promise((resolve7) => {
     let stdout = "";
@@ -4480,10 +4475,10 @@ function parseLine(line) {
 var documentTool = {
   name: "document",
   category: "Project",
-  description: "Automatically generate or update documentation comments (JSDoc/TSDoc style) for code. Can target specific symbols or entire files/directories.",
-  usageHint: "USE FOR IMPROVING CODE DOCUMENTATION:\n\n- Good for adding missing docs to public APIs or complex functions.\n- `overwrite: true` will replace existing documentation (use carefully).\n- You can target specific symbols via `target` or whole files/directories via `files`.\nAlways review the generated documentation before committing \u2014 the model can hallucinate details.",
-  permission: "confirm",
-  mutating: true,
+  description: "Preview documentation comments (JSDoc/TSDoc style) that would be generated for code symbols. Returns a list of candidates with status `skipped` \u2014 the tool is currently a read-only preview and does NOT write to files.",
+  usageHint: "USE FOR IMPROVING CODE DOCUMENTATION:\n\n- Good for adding missing docs to public APIs or complex functions.\n- Currently this is a PREVIEW-ONLY tool: it does not modify files.\n- Use the output to decide which symbols to document manually, or pass the candidates to `edit` / `patch`.\n- `overwrite`, `style`, and `target` parameters are accepted for future expansion but are ignored today.\nAlways review the proposed documentation before applying it \u2014 the model can hallucinate details.",
+  permission: "auto",
+  mutating: false,
   timeoutMs: 3e4,
   inputSchema: {
     type: "object",
@@ -4558,8 +4553,8 @@ async function resolveFiles2(filesInput, cwd) {
   for (const f of files) {
     const absPath = f.trim().startsWith("/") ? f.trim() : `${cwd}/${f.trim()}`;
     try {
-      const stat11 = await fs4.stat(absPath);
-      if (stat11.isFile()) resolved.push(absPath);
+      const stat10 = await fs4.stat(absPath);
+      if (stat10.isFile()) resolved.push(absPath);
     } catch {
     }
   }
@@ -6987,18 +6982,18 @@ async function runIndexer(_ctx, opts) {
     for (const meta of store.getAllFileMetas()) existingMeta.set(meta.file, meta);
   }
   for (const file of files) {
-    let stat11;
+    let stat10;
     try {
-      stat11 = await fs4.stat(file);
+      stat10 = await fs4.stat(file);
     } catch {
       store.deleteFile(file);
       continue;
     }
-    if (!stat11.isFile()) continue;
+    if (!stat10.isFile()) continue;
     const lang = detectLang(file);
     if (!lang) continue;
     const meta = existingMeta.get(file);
-    if (!force && meta && meta.mtimeMs === Math.floor(stat11.mtimeMs)) {
+    if (!force && meta && meta.mtimeMs === Math.floor(stat10.mtimeMs)) {
       langStats[lang] = (langStats[lang] ?? 0) + meta.symbolCount;
       symbolsIndexed += meta.symbolCount;
       filesIndexed++;
@@ -7024,7 +7019,7 @@ async function runIndexer(_ctx, opts) {
       store.upsertFile({
         file,
         lang,
-        mtimeMs: Math.floor(stat11.mtimeMs),
+        mtimeMs: Math.floor(stat10.mtimeMs),
         symbolCount: 0,
         lastIndexed: Date.now()
       });
@@ -7050,7 +7045,7 @@ async function runIndexer(_ctx, opts) {
     store.upsertFile({
       file,
       lang,
-      mtimeMs: Math.floor(stat11.mtimeMs),
+      mtimeMs: Math.floor(stat10.mtimeMs),
       symbolCount: count,
       lastIndexed: Date.now()
     });
@@ -7081,8 +7076,9 @@ var codebaseIndexTool = {
   category: "Project",
   description: "Build or incrementally update the project-wide symbol index. This powers fast codebase search and understanding. By default it only processes files that have changed since the last indexing run.",
   usageHint: "IMPORTANT FOR LARGE CODEBASES:\n\n- First run (or after major changes): consider `force: true` for a clean rebuild.\n- Normal usage: call without arguments for fast incremental updates.\n- Use `langs` to restrict to specific languages if you only care about certain parts of the project.\nThis tool is relatively expensive \u2014 do not call it on every turn. Use it when the index is stale or before heavy codebase-search sessions.",
-  permission: "auto",
+  permission: "confirm",
   mutating: true,
+  capabilities: ["fs.write.outside-project"],
   timeoutMs: 12e4,
   inputSchema: {
     type: "object",